0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2022, 19:44

Target

0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll
Size

80KB
MD5

672c25d9d70f3c6069ac69e7d8900c44
SHA1

3d4ce60fe84612383a76d3b8ff5b6eaaafd77f11
SHA256

0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531
SHA512

c31258717e899aec049ff8b84376e46a0b281e5d214d3093e5d925a796f8c472d153da60c8c991a3752edf1d429922cf765fa6ba38f475abefa9f44ebecb6dee
SSDEEP

768:7kyMTgHs6AJnf+oZzF7yxPMHjfnC74Ko9A3jC2rkbX9QqLWWt0pXzP2UKv9vb1n0:7kyMTgM1Jnf5FTDKoKCuu9QAdAAl/Du

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3912	DPGLic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 8	3300	regsvr32.exe	81
PID 3300 wrote to memory of 8	3300	regsvr32.exe	81
PID 3300 wrote to memory of 8	3300	regsvr32.exe	81
PID 8 wrote to memory of 3912	8	regsvr32.exe	82
PID 8 wrote to memory of 3912	8	regsvr32.exe	82
PID 8 wrote to memory of 3912	8	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\DPGLic.exe
    C:\Users\Admin\AppData\Local\Temp\DPGLic.exe
    3⤵
    - Executes dropped EXE
    PID:3912

C:\Users\Admin\AppData\Local\Temp\DPGLic.exe

Filesize
27KB

MD5
b624242e7d33bf16e07aa3025cf3a526

SHA1
34e3f465ec4fd14d25bf5416f28f7e7d5952f39a

SHA256
b800480175d41b937bdf15bcd8cf7f28f3b8e8e97221c8cfeeb6c1f2c794c2f0

SHA512
b02bf6705921abc6b9e75e08a6bd76e0748fa76eba5f4f5bcd281484b924e2a9351f854ac93e6b6a3fc59f29e1c1086cd4b270eff5c962f464f771623c1e2760

Download Submit
C:\Users\Admin\AppData\Local\Temp\DPGLic.exe

Filesize
27KB

MD5
b624242e7d33bf16e07aa3025cf3a526

SHA1
34e3f465ec4fd14d25bf5416f28f7e7d5952f39a

SHA256
b800480175d41b937bdf15bcd8cf7f28f3b8e8e97221c8cfeeb6c1f2c794c2f0

SHA512
b02bf6705921abc6b9e75e08a6bd76e0748fa76eba5f4f5bcd281484b924e2a9351f854ac93e6b6a3fc59f29e1c1086cd4b270eff5c962f464f771623c1e2760

Download Submit
memory/3912-136-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3912-137-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download